IDMappingExtUtils.traceString("incoming stsuu = " + stsuu.toString());​

Try taking a look at Advanced Configuration parameters:

- sps.httpRequestClaims.enabled (by default is false, try true)
- sps.httpRequestClaims.filterSpec (this should be set by default)

Trace the entire stsuu in the pre-token mapping rule when accessing the /authorize endpoint and see if there is any extra data in there.

Really you should not be doing this in a pre-token mapping rule at all, but instead using an access policy associated with the OAuth protection definition, or context-based authorization policy attached to the /authorize resource to make decisions about the authenticity of the request.

You can try adding this snippet

// Example: Retrieve HTTP request claim, which contains various information
//          about the incoming HTTP request (e.g., headers, cookies, POST
//          parameters, query string parameters). HTTP request claim can be
//          configured using advanced configurations under category
//          "sps.httpRequestClaims"./*
var claims = stsuu.getRequestSecurityToken().getAttributeByName("Claims").getNodeValues();for (var i = 0; i < claims.length; i++) {
    var dialect = claims[i].getAttribute("Dialect");    if ("urn:ibm:names:ITFIM:httprequest".equalsIgnoreCase(dialect)) {
        var headers = claims[i].getElementsByTagName("Header");        for (var j = 0; j < headers.getLength(); j++) {
            var header = headers.item(j);
            var name   = header.getAttribute("Name");
            var values = header.getElementsByTagName("Value");            for (var k = 0; k < values.getLength(); k++) {
                var value = values.item(k).getTextContent();                IDMappingExtUtils.traceString("Header with name [" + name + "] and value [" + value + "]");
            }
        }
    }
}

// Example: Retrieve HTTP request claim, which contains various information
//          about the incoming HTTP request (e.g., headers, cookies, POST
//          parameters, query string parameters). HTTP request claim can be
//          configured using advanced configurations under category
//          "sps.httpRequestClaims"./*
var claims = stsuu.getRequestSecurityToken().getAttributeByName("Claims").getNodeValues();for (var i = 0; i < claims.length; i++) {
    var dialect = claims[i].getAttribute("Dialect");    if ("urn:ibm:names:ITFIM:httprequest".equalsIgnoreCase(dialect)) {
        var headers = claims[i].getElementsByTagName("Header");        for (var j = 0; j < headers.getLength(); j++) {
            var header = headers.item(j);
            var name   = header.getAttribute("Name");
            var values = header.getElementsByTagName("Value");            for (var k = 0; k < values.getLength(); k++) {
                var value = values.item(k).getTextContent();                IDMappingExtUtils.traceString("Header with name [" + name + "] and value [" + value + "]");
            }
        }
    }
}

// Example: Retrieve HTTP request claim, which contains various information
//          about the incoming HTTP request (e.g., headers, cookies, POST
//          parameters, query string parameters). HTTP request claim can be
//          configured using advanced configurations under category
//          "sps.httpRequestClaims"./*
var claims = stsuu.getRequestSecurityToken().getAttributeByName("Claims").getNodeValues();for (var i = 0; i < claims.length; i++) {
    var dialect = claims[i].getAttribute("Dialect");    if ("urn:ibm:names:ITFIM:httprequest".equalsIgnoreCase(dialect)) {
        var headers = claims[i].getElementsByTagName("Header");        for (var j = 0; j < headers.getLength(); j++) {
            var header = headers.item(j);
            var name   = header.getAttribute("Name");
            var values = header.getElementsByTagName("Value");            for (var k = 0; k < values.getLength(); k++) {
                var value = values.item(k).getTextContent();                IDMappingExtUtils.traceString("Header with name [" + name + "] and value [" + value + "]");
            }
        }
    }
}